We show you what leaves your CRM for us — and what never does
A page for the people who approve the connection. Not a word of “we care about your security”: a list of what the widget takes, what it does not, which permissions it asks for and how long data lives after you disconnect.
Four questions we get asked first
What if your side leaks our client base?
There is nothing to leak: no personal data sits in any table. The database schema has no fields for names, phone numbers, emails or free text — there is nowhere to write them, so there is nothing to delete. This is the data model, not a policy promise: verified by the column list, not by trust.
Then where do the names in drill-downs come from?
They are fetched by the manager’s own browser. When they open the deal list behind a number, the names are requested directly from amoCRM — with their own session and their own permissions. They never reach us, not even for a second, and never land in logs.
Will you be able to change anything in our CRM?
We will not: our amoCRM client has no write methods — only GET, and a direct API call bypassing the client fails review and build. On connection we request one permission out of 5 — “Account data”; we do not request the others: “File access”, “File deletion”, “Notification centre”, “Amma”. amoCRM has no separate read-only permission, and we do not promise one.
Could another client’s data show up in our reports?
No: isolation sits at the database row level. The database is Neon, AWS eu-central-1, Frankfurt. Every row carries an account ID and the database policy returns only the current account’s rows; the context is set from the verified amoCRM request signature, not from the body. A wrong condition in code cannot leak data — the database filters, not the query.
amoCRM permissions verified against the developer documentation on 21.08.2026: there is no separate “read-only” permission. Database region and isolation — docs/БЭКЕНД.md.
What we read and what we do not
We read
- Pipelines, stages and their order
- Stage transitions: from where, to where and at what second
- Who moved the deal — the amoCRM user ID, no name
- Deal amounts
- Values of whitelisted analytical fields
We neither read nor store
- Client names and company names
- Phone numbers and email addresses
- Note and message text
- Deal attachments and files
- Call recordings and transcripts
Separately — what we do not read not on principle but because it is not in the sync yet: tasks and their deadlines; calls, their duration and outcome; chat and email correspondence. The widget has no reports on them either. When they appear, they appear in the list on the left, not quietly in the database.
Data model verified against the database schema and the amoCRM client, widget version 1.1.8.
You define the field whitelist
By default no custom fields are synced. The administrator names the breakdown fields one by one, and only list values are taken — never free text. A field that could contain a name, phone number or email is not whitelisted.
On the pilot property developer account the whitelist looks like this: Loss reason, Project name, Source, Purchase purpose, Deal budget, Country of enquiry, Apartment type, Finishing. None of them are contact details — they describe the property and the lead.
anonymised property developer account: 240,031 transitions between stages analysed, 7 years of history. Measured 25.08.2026, docs/РЕШЕНИЯ.md, пункты 37 и 40.
AI review: names never leave the browser
The aggregates for the review are built in the browser, where manager names are replaced with masks and later unmasked. Only numbers go out: stage entries, conversions, median times, field fill rates. Neither the model nor our server sees the names.
Request size is capped so the call cannot become an arbitrary-volume channel, and rate is capped so it cannot be used as someone else’s gateway to the model. Insights are computed by code: without a connected model the tab keeps working and says plainly that there will be no natural-language explanations.
Who we share data with
| Provider | Purpose | What it sees |
|---|---|---|
| Neon | Database hosting, AWS eu-central-1 | Anonymised transitions, aggregates, reference data |
| Vercel | Hosting for the site, reports API and widget page | Request traffic, no bodies with personal data |
| External sign-in provider | Sign-in to the account on the site | The account owner’s email. Sees no CRM data |
| External model provider | The “AI review” tab, only when the user clicks | Aggregates with masks instead of names |
The list is closed: the widget has no advertising or analytics trackers that CRM data could go to.
Disconnect us at any moment — without our involvement
Open “Granted access” in amoCRM
Access is granted by a specific account administrator and is listed there by name, along with the date it was granted.
Result: you see who owns the connection, with no need to write to us.
Click “Revoke”
No consent from us is needed and there is nothing to confirm on our side. We have nothing to write to your CRM with anyway — and never had.
Result: the sync stops immediately, no new data arrives.
Write to us if the accumulated data must go sooner
After disconnection we keep the accumulated data for 90 days, then delete it: clients come back and do not want to lose history, but we do not promise to keep it indefinitely. The same period is stated in the data processing policy.
Result: we delete your account’s rows on a single email — no conditions, no attempts to talk you out of it.
- Permissions inside reports are inherited from amoCRM: a manager sees their own deals, a group head sees the group, an administrator sees everything. The widget extends nobody’s access.
What we do not claim
- We hold no information security certificates. We have not been audited and will not write “compliant”.
- There is no separate data processing agreement (DPA) yet. We are preparing one for the first corporate client; on request we discuss it right away.
- amoCRM has no “read-only” permission. We describe what limits us on our side rather than pointing to a checkbox that does not exist.
Send your questionnaire — we answer in writing, point by point
No call needed. If the answer is “we do not have that”, that is what we will write: a page about data and access is the last place to round things off.